Subject: FYI 4 update: security considerations

From: April Marine <[email-masked]>
Date: Thu, 31 Dec 1998 10:17:25 -0800 (PST)

Happy New Year all!

I was on the hook to revise the Security Considerations section of the
update to FYI 4.  So, here is a crack at it.  I have a feeling that there
are some who will not like this approach, so I thought I would run it by
the whole list insteading of just slipping it to Ray.  

Things I think might be contentious: 1. it may be too long?  2. it may be
too negative? 

I tried to address the top 3 or 4 security-related things I think a new
user should be aware of, but these may be things only I feel strongly
about.  So I toss it to the list to see where consensus may reign.

thanks,
April
----------

FYI 4
3. Security Considerations

   The question "is the Internet secure?" can be a confusing one for a
   new user, who will hear many assurances that it is secure and many
   scary stories saying it is not secure.  There are a few basic rules
   of thumb to remember that will address most concerns.

   First, users should make it a rule never to share their account
   passwords with anyone, certainly never with anyone unknown to them.
   Learning a password is the easiest way for someone to break into a
   system.  Possibly a user may think that their files are not that
   interesting to anyone, but someone may be able to get a foothold
   from one innocuous account to other places in the same computer
   system.  Many good security practices for users can be found in the
   Users Security Handbook (FYI?).

   Second, understand that there are means for people to track the
   information a user sends via email, the files one downloads, and
   the sites visited on the web.  People with legitimate system
   priviledges have access to information that a user may prefer to keep
   private.  No responsible site administrator or network engineer
   will violate users' privacy out of personal curiousity; however,
   people with legitimate system or network priviledges have access to
   information about users.  If someone less legitimate gains such
   priviledges, possibly by attaining illegal access to a system, they
   also will have access to this information.  This situation is not a
   problem for most people, but it should be understood that email
   sent a year ago may still exist in some system's backup archive
   tape and theoretcially could be resurrected and reviewed.

   Third, before giving personal information over the Internet, such
   as filling in a form on a Web page, a user should review the site's
   privacy policy to see how they will use and protect this
   information.  Do they sell their users' names and email addresses?
   Do they share them with their advertising partners?  Do they couple
   names with the pages visited and provide that information to their
   associates?  It is best to understand how far such information will
   go before providing it, and a responsible site will be happy to
   explain their policies regarding privacy of information.

   Finally, there are means to heighten the security and privacy of
   one's Internet usage.  Details are beyond the scope of this
   document, but means for encrypting data, for digitally signing
   messages and files, for doublechecking the authenticity of
   information, and for filtering out portions of Internet data exist.
   One can find more information about these options by using a search
   engine to find information about "data encrpytion", "digital
   signatures", "babysitting software", or "checksums".

---

From: Michael Sondow <[email-masked]>
Date: Thu, 31 Dec 1998 16:20:34 -0500

Sounds good to me. It certainly isn't too long, IMHO. Security is a VERY big
concern, and new users are very perplexed and rather frightened by the whole
thing. I think it wouldn't be amiss to mention PGP, signatures, and the fact
that Netscape and other browsers offer security mechanisms. Giving a link or
reference to the Handbook is a good idea.

What about spam? You haven't mentioned it, and it's a big issue (both
receiving spam and sending it). Maybe you should give new users a little
pep- talk about spam, as well.

---

From: April Marine <[email-masked]>
Date: Thu, 31 Dec 1998 13:26:47 -0800 (PST)

> pep- talk about spam, as well.

Good point.  We should refer (I think Ray is already planning to do so) to
the Netiquette and Don't Spew docs (if that Spew one ever gets through the
IESG--it's almost there! :-).  That will prevent us from having to repeat
too much.

It may be nice to annotate the references section to let people know a
tiny bit about what the docs we're recommending contain.  What do the
authors think?

thanks for the comments!
April

---

From: Michael Sondow <[email-masked]>
Date: Thu, 31 Dec 1998 20:32:44 -0500

> tiny bit about what the docs we're recommending contain.  What do the

I suppose you must be talking about the new FYI, here. I'm not really sure
what you mean, though, because I haven't seen the proposed document. Is it
available somewhere?